CVE-2022-23911: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-23911) affects the AP Custom Testimonial WordPress plugin versions before 1.4.7. The issue was discovered and disclosed on January 25, 2022. The vulnerability exists in the plugin's testimonial editing functionality where it fails to properly validate and escape the 'id' parameter before using it in SQL statements (WPScan).

The vulnerability is classified as a SQL Injection with a CVSS score of 6.8 (medium severity). The issue occurs in the testimonial editing functionality where the 'id' parameter is not properly validated or escaped before being used in SQL queries. This vulnerability is categorized under OWASP Top 10 A1: Injection and CWE-89 (WPScan).

If exploited, this vulnerability could allow authenticated users with administrative access to perform SQL injection attacks against the WordPress database, potentially leading to unauthorized data access, modification, or deletion of database contents (CVE Mitre).

A proof of concept exists demonstrating the vulnerability can be exploited via the URL path '/wp-admin/admin.php?page=apct_testimonial_edit&id=' with a malicious SQL payload. The exploit requires authentication with administrative privileges (WPScan).

The vulnerability was patched in version 1.4.8 of the AP Custom Testimonial plugin. Users are advised to update to this version or later to protect against this security issue (WordPress Plugin).